On your own server, run by your IT team.

The app

The web app and the API the iPads call. Only the proxy reaches it.

PostgreSQL 16

The database, on the internal network. Its port is never published.

File storage

An S3-compatible store for photos, documents and the sealed copies of the audit trail, on the internal network only.

The scheduler

Seals the audit trail every 15 minutes and runs the retention purge once a day.

Caddy

Serves HTTPS for the plant’s host name and holds the only published port. Your own proxy can take its place.

A Linux server

Docker Engine 24 or later with the Compose plugin 2.24 or later. 4 CPU, 8 GB of memory and 100 GB of disk are enough for one plant.

A host name

A name in a domain the plant controls, resolving to the server on the plant network.

Our image registry

Access to pull a release when you install or upgrade, with the token our support team gives you.

A certificate the iPads trust

Caddy issues one and you push its root to the iPads by MDM, or the plant’s own proxy serves HTTPS in front of the app.

Records, photos, documents and backups live on the server, and people reach it over the plant network. Once installed, it runs on that network alone: it sends no email, calls no AI service, and its licence is a file you install. It goes to the internet only when you pull a new release.

Signed with our key

Every release is a container image signed with our own key. Your IT team checks the signature with cosign before installing, and a built-in check re-hashes every file in the running image against the release manifest.

Upgrades on your schedule

One command pulls the new release, backs up the database, applies the new migrations and restarts the stack. Nothing updates on its own.

Locked-down containers

The app runs as an unprivileged user on a read-only filesystem, with every Linux capability dropped.

One command line

totalmos-ctl installs the licence and the first plant, resets passwords and sets up the ERP connection. Each command that changes the plant asks for a reason and lands in the audit log with the operator’s name.

A login for everyone

Admins add people on the Team page with a one-time password. A login can be a plain username, so operators without a work email can sign in.

Passwords that hold

At least twelve characters, checked against common words and keyboard runs, and changed at the first sign-in.

Lockout and sessions

Repeated failures slow every new attempt. Admins can disable an account, clear a lockout or end its sessions from either app.

Roles checked by the server

Five roles, from admin to batcher, enforced by the API on every request, not only hidden on the screen.

Every upgrade backs up the database first. The installation guide gives the nightly backup of the database and the file store, and the steps to restore them. For production we recommend point-in-time recovery with your own tools, such as pgBackRest.